PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems
This work exposes a critical security vulnerability in LLM-based coding agent skill ecosystems, highlighting the need for resource-level vetting and execution-time containment.
PhantomSkill introduces an attack framework that hides malicious code in agent skills' auxiliary resources using VulMask, which rewrites malicious scripts into vulnerability-shaped implementations activated only under attacker-controlled triggers. It reduces warning and malware detection rates compared to overt malicious scripts while preserving benign utility across various agents and models.
Agent skills allow LLM-based coding agents to acquire domain-specific capabilities from third-party packages, but they also introduce a new supply-chain attack surface. We present PhantomSkill, an attack framework that hides malicious behavior in a skill's auxiliary resources rather than in its textual description. Its core technique, VulMask, rewrites overt malicious scripts into vulnerability-shaped implementations whose malicious behavior is activated only under attacker-controlled trigger conditions. This design shifts the visible signal from explicit malicious intent to ordinary-looking insecure code. Across representative host skills, attack goals, coding agents, generation models, and automated reviewers, VulMask preserves benign utility while reducing warning and malware-level detection compared with overt malicious scripts. Our results show that skill ecosystems require resource-level vetting, execution-time containment, and security policies that treat exploitable vulnerabilities in agent skills as potential malicious payloads.